CVE-2019-17555: Improper input validation in Apache Olingo
Summary
CVE-2019-17555: Improper input validation in Apache Olingo. Affects org.apache.olingo:odata-client-core versions >= 4.0.0, < 4.7.0. Fixed in 4.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Olingo is a Java library that implements the Open Data Protocol (OData) for building and consuming RESTful APIs. It provides a set of client and server libraries for working with OData services. The OData client core package, org.apache.olingo:odata-client-core, is affected by a vulnerability that allows for improper input validation.
Vulnerability Detail
The vulnerability, identified as CVE-2019-17555, exists in the AsyncResponseWrapperImpl class of Apache Olingo versions 4.0.0 to 4.6.0. When processing the Retry-After header, the class directly passes its value to the Thread.sleep() method without any validation. This means that if a malicious server includes an excessively large value in the Retry-After header, it can lead to a Denial of Service (DoS) attack. By exploiting this vulnerability, an attacker can cause the affected application to become unresponsive or consume excessive resources, potentially impacting its availability.
How To Fix
Minimum fixed version
4.7.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented. The Retry-After header should be validated and its value should be checked against a reasonable threshold before passing it to the Thread.sleep() method. This can be done by implementing custom logic to limit the maximum value accepted for the Retry-After header.
Conclusion
In conclusion, the improper input validation vulnerability in Apache Olingo versions 4.0.0 to 4.6.0 can lead to a Denial of Service (DoS) attack. To mitigate this vulnerability, it is advised to upgrade to Apache Olingo version 4.7.0 or later. If immediate upgrade is not possible, implementing a custom validation for the Retry-After header can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.olingo:odata-client-core →
FAQ
Apache Olingo is a Java library for working with OData services, providing client and server implementations.
The vulnerability affects Apache Olingo versions 4.0.0 to 4.6.0.
The vulnerability allows for a potential Denial of Service (DoS) attack, where a malicious server can cause the affected application to become unresponsive or consume excessive resources.
To fix this vulnerability, it is recommended to upgrade to Apache Olingo version 4.7.0 or later.
Yes, a temporary workaround can be implemented by validating the Retry-After header and limiting its value before passing it to the Thread.sleep() method.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.olingo:odata-client-core.
